Analysis
- max time kernel
149s - max time network
146s - platform
windows10_x64 - resource
win10v20201028 - submitted
30/03/2021, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
Order Drawing.exe
Resource
win7v20201028
windows7_x64
General
- Target Order Drawing.exe
- Size 680KB
- Sample210330-w49wlm85da
- SHA256 59376f91fb0637be9672bb23efc91acf2ef949826c74dfb927146f9799eecd08
- MD5 0a6783edefd2bdd6db218a6c1573836d
- SHA1 71d5e7699ac71519f95120ffc617919469858330
- SHA512 705f368165d75a10777f84c20f98fc8e347122caa11c7fe99ab203288fbce0dc227752a8d8a9f84d417832996f2de34a1738308e34e2642d1f55ac14649fed5b
- MD5 SHA1 SHA512
Malware Config
Extracted
-
xloader
-
http://www.heartyhost.net/uerb/
-
crownedopulencepodcast.com
-
nanashiblog.info
-
kuppers.info
-
techlandy.com
-
katano-tetsuo.com
-
slatonresources2.com
-
havegamewilltravel.com
-
fingusid.com
-
hmcbeauty.com
-
floridaindustriallogistics.com
-
therxplug.com
-
jokerprime.com
-
matzinnovation.com
-
thenumnut.com
-
moneyhaus.info
-
cehoq.com
-
migaleriapanama.com
-
fengjin.net
-
hempiredublights.com
-
eadseconcibrasil.com
-
grooveperiod.com
-
scyihai.net
-
razecollections.com
-
onetwatrlp.online
-
alanalajoieomalley.com
-
eclatworld.net
-
fklabo.xyz
-
zenkinnsfood.com
-
1998kai.com
-
pubgrewardcenter.com
-
successfullegacy.com
-
lynkfly.com
-
unievrsityhealthplans.com
-
tebarsejutaalquran.com
-
alliancefb.com
-
liveoppsnow.com
-
cchubs.com
-
haemhq.com
-
fashionedway.com
-
nexiou.com
-
waterprooflouisville.com
-
mortgagesolutionstporates.net
-
bigstinkycat.com
-
crystalhollowshop.com
-
goodfurn.com
-
spacetasks.com
-
kevinsheepdoghull.com
-
antgroupco.ltd
-
solutions-corder.com
-
corporationoftron.site
-
comfyfurry.com
-
lcrpro.com
-
i-sellandbuy.com
-
saffronmackie.com
-
44ay54al.cloud
-
hyvizli.net
-
figurebay.net
-
parkhomeinsulation.com
-
manxiangcha.com
-
amsterdamdistrict.com
-
technowire.tech
-
banglaislam.net
-
alexiamanager.com
-
samegoods.com
Signatures
- Xloader Payload 1 IoCs
resource yara_rule behavioral2/memory/4164-8-0x0000000000180000-0x00000000001A8000-memory.dmp xloader - Blocklisted process makes network request 2 IoCs
flow pid Process 19 4164 cmd.exe 23 4164 cmd.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4704 set thread context of 3136 4704 Order Drawing.exe 78 PID 3136 set thread context of 2300 3136 Order Drawing.exe 21 PID 4164 set thread context of 2300 4164 cmd.exe 21 - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 3136 Order Drawing.exe 3136 Order Drawing.exe 3136 Order Drawing.exe 3136 Order Drawing.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe 4164 cmd.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3136 Order Drawing.exe 3136 Order Drawing.exe 3136 Order Drawing.exe 4164 cmd.exe 4164 cmd.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3136 Order Drawing.exe Token: SeDebugPrivilege 4164 cmd.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4704 Order Drawing.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2300 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4704 wrote to memory of 3136 4704 Order Drawing.exe 78 PID 4704 wrote to memory of 3136 4704 Order Drawing.exe 78 PID 4704 wrote to memory of 3136 4704 Order Drawing.exe 78 PID 4704 wrote to memory of 3136 4704 Order Drawing.exe 78 PID 2300 wrote to memory of 4164 2300 Explorer.EXE 79 PID 2300 wrote to memory of 4164 2300 Explorer.EXE 79 PID 2300 wrote to memory of 4164 2300 Explorer.EXE 79 PID 4164 wrote to memory of 3812 4164 cmd.exe 80 PID 4164 wrote to memory of 3812 4164 cmd.exe 80 PID 4164 wrote to memory of 3812 4164 cmd.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\Order Drawing.exe"C:\Users\Admin\AppData\Local\Temp\Order Drawing.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\Order Drawing.exe"C:\Users\Admin\AppData\Local\Temp\Order Drawing.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order Drawing.exe"3⤵PID:3812
-
-